the only mass solution i found to this was that i installed pgadmin, logged into the db, and manually removed all the bot accounts from local_user
. you should also remove them from the person
table as well (you can easily find them if you do SELECT * FROM person WHERE local = true ORDER BY published DESC
in the query tool), that way they don’t show up in your instance stats, but removing them from local_user
would be enough to stop them from logging in.
this has to be illegal.
like, no, seriously. i’m not a lawyer but i was working on a (since failed) startup in 2018 and distinctly remember how much headache the gdpr caused. literally one of the main things was that you cannot coerce users into consenting to data processing, or make features conditional to them. the gdpr makes a distinction between processing you do to perform a contract (that’s why no one asks for your consent for processing your email address to log you in, that’s implied) and processing you do for other reasons, which require user consent (that’s why everyone asks if they can spam you on the same email – it doesn’t matter that your email address is already on their server, processing it for marketing reasons requires consent of the data subject). opting into these kinds of processing needs to be granular, if it’s not they lose the validity of your consent.
i seriously hope facebook gets slapped so hard over this that no one ever thinks about doing this again. “paying with your data” should never be a thing in any society that calls itself civilized.